@kryd/cli 0.14.0 → 0.16.0

package/dist/index.js

@@ -8,6 +8,22 @@ var __export = (target, all) => {
 // src/index.ts
 import { Command } from "commander";
 
+// ../../packages/shared-types/dist/api.js
+var ERROR_CODES = {
+  validationFailed: "validation.failed",
+  unauthorized: "auth.unauthorized",
+  forbidden: "auth.forbidden",
+  notFound: "resource.not_found",
+  conflict: "resource.conflict",
+  unprocessable: "request.unprocessable",
+  badRequest: "request.bad",
+  internal: "internal.error",
+  // KRYD-516b: a request that names no account while the caller is in several (400), and a member
+  // whose role lacks the route's permission (403, `details.permission` names it).
+  accountRequired: "account.required",
+  permissionRequired: "auth.permission_required"
+};
+
 // ../../packages/shared-types/dist/db-url.js
 function isValidPostgresConnectionString(value) {
   if (value.length === 0 || /\s/.test(value))
@@ -14875,6 +14891,42 @@ function parseTicketNumber(raw) {
 var TICKET_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 var TICKET_ATTACHMENT_MAX_SIZE_LABEL = `${TICKET_ATTACHMENT_MAX_BYTES / (1024 * 1024)} MB`;
 
+// ../../packages/shared-types/dist/permissions.js
+var PERMISSIONS = [
+  /** Open the site of a private preview or a closed production (enforced from KRYD-575). */
+  "app:view",
+  /** See the account itself: name, slug. */
+  "account:view",
+  /** Rename the account and change its slug. */
+  "account:manage",
+  /** See who is a member, and the invites still open. */
+  "members:view",
+  /** Invite people, change a member's role, remove a member. */
+  "members:manage",
+  /** See usage and costs. */
+  "usage:view",
+  /** See projects, deploys, domains, databases, storage, AI and workflows. */
+  "projects:view",
+  /** Change a project: env vars, domains, databases, storage, AI, workflows, remove it. */
+  "projects:manage",
+  /** Read env var VALUES (secrets), not only their names. */
+  "env:read",
+  /** Link a repository, deploy, roll back, get a push credential, manage deploy hooks. */
+  "deploy",
+  /** Read build and runtime logs. */
+  "logs:view",
+  /** Trigger, cancel and replay workflow runs; add and remove crons and schedules. */
+  "workflows:run",
+  /** Open and answer support tickets. */
+  "support"
+];
+var ROLES = {
+  owner: PERMISSIONS,
+  member: PERMISSIONS.filter((p) => p !== "members:manage" && p !== "account:manage"),
+  viewer: ["app:view"]
+};
+var ACCOUNT_HEADER = "Kryd-Account";
+
 // ../../packages/shared-types/dist/workflow-run.js
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
@@ -14936,6 +14988,209 @@ import {
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
+// src/config.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var DEFAULT_API_URL = "http://localhost:3000";
+function configPath() {
+  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
+  return join(dir, "config.json");
+}
+function loadConfig() {
+  let raw;
+  try {
+    raw = readFileSync(configPath(), "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    process.stderr.write(
+      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
+`
+    );
+    return {};
+  }
+}
+function resolveToken() {
+  const fromEnv = process.env.KRYD_TOKEN?.trim();
+  return fromEnv ? fromEnv : loadConfig().token;
+}
+function writeConfig(config2) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+}
+function saveToken(token, apiUrl) {
+  const config2 = loadConfig();
+  config2.token = token;
+  if (apiUrl) config2.apiUrl = apiUrl;
+  writeConfig(config2);
+}
+function clearToken() {
+  const config2 = loadConfig();
+  delete config2.token;
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+function saveAccount(account) {
+  const config2 = loadConfig();
+  config2.account = account.accountId;
+  if (account.slug) config2.accountSlug = account.slug;
+  else delete config2.accountSlug;
+  writeConfig(config2);
+}
+function clearAccount() {
+  const config2 = loadConfig();
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+var DEPLOY_TOKEN_PREFIX = "kryd_";
+function accountHeader(token) {
+  if (!token || token.startsWith(DEPLOY_TOKEN_PREFIX)) return {};
+  const account = loadConfig().account;
+  return account ? { [ACCOUNT_HEADER]: account } : {};
+}
+function authHeaders(token) {
+  return { authorization: `Bearer ${token}`, ...accountHeader(token) };
+}
+var lastApiUrl = null;
+function resolveApiUrl(flag) {
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
+}
+var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
+function resolveDashboardUrl(flag) {
+  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
+}
+var PROJECT_LINK_DIR = ".kryd";
+var PROJECT_LINK_FILE = "project.json";
+function findProjectLinkDir(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
+    if (existsSync(join(dir, ".git"))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function loadProjectLink(cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
+`);
+    return null;
+  }
+  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
+    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
+`);
+    return null;
+  }
+  return parsed;
+}
+function saveProjectLink(cwd, link) {
+  const dir = join(cwd, PROJECT_LINK_DIR);
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, PROJECT_LINK_FILE);
+  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
+  return path;
+}
+function ensureIgnored(cwd, entry, aliases = []) {
+  const path = join(cwd, ".gitignore");
+  let current = "";
+  try {
+    current = readFileSync(path, "utf8");
+  } catch {
+  }
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
+  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+  appendFileSync(path, `${prefix}${entry}
+`);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
+function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
+  if (explicit) return explicit;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
+}
+
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
@@ -14965,7 +15220,7 @@ async function parseEnvelope(res) {
 }
 async function whoami(apiUrl, token) {
   const res = await fetch(`${apiUrl}/me`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -14981,7 +15236,7 @@ async function linkProject(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify(input)
   });
@@ -15005,7 +15260,7 @@ async function attachDatabase(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId: input.projectId,
@@ -15036,7 +15291,7 @@ async function createStorage(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15058,7 +15313,7 @@ async function enableAi(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15077,7 +15332,7 @@ async function enableAi(apiUrl, token, input) {
 }
 async function getAiStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15095,7 +15350,7 @@ async function getAiStatus(apiUrl, token, projectId) {
 async function removeAi(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15117,7 +15372,7 @@ async function addWorkflows(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15132,7 +15387,7 @@ async function addWorkflows(apiUrl, token, input) {
 }
 async function getWorkflowStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15146,7 +15401,7 @@ async function getWorkflowStatus(apiUrl, token, projectId) {
 async function removeWorkflows(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15197,7 +15452,7 @@ function domainsUrl(apiUrl, projectId) {
 }
 async function listDomains(apiUrl, token, projectId) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain listing failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15214,7 +15469,7 @@ async function listDomains(apiUrl, token, projectId) {
 async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
     method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    headers: { "content-type": "application/json", ...authHeaders(token) },
     body: JSON.stringify({ host, ...app ? { app } : {}, ...redirectTo !== void 0 ? { redirectTo } : {} })
   });
   if (!res.ok) {
@@ -15225,7 +15480,7 @@ async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
 async function removeDomain(apiUrl, token, projectId, host) {
   const res = await fetch(`${domainsUrl(apiUrl, projectId)}/${encodeURIComponent(host)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15237,7 +15492,7 @@ function deployHookUrl(apiUrl, projectId) {
 async function createDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "PUT",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook creation failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15251,7 +15506,7 @@ async function createDeployHook(apiUrl, token, projectId) {
 async function removeDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15264,7 +15519,7 @@ async function removeDeployHook(apiUrl, token, projectId) {
 }
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15347,7 +15602,7 @@ async function pollResourceDetached(fetchStatus, opts) {
 async function detachDatabase(apiUrl, token, projectId) {
   const res = await fetch(
     `${apiUrl}/databases/${encodeURIComponent(projectId)}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15359,7 +15614,7 @@ async function detachDatabase(apiUrl, token, projectId) {
 }
 async function getProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15369,7 +15624,7 @@ async function getProject(apiUrl, token, projectId) {
 }
 async function listProjects(apiUrl, token) {
   const res = await fetch(`${apiUrl}/projects`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15379,7 +15634,7 @@ async function listProjects(apiUrl, token) {
 async function deleteProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15412,7 +15667,7 @@ async function pollProjectDeleted(read, opts) {
 async function detachStorage(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/storage/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15425,7 +15680,7 @@ async function detachStorage(apiUrl, token, projectId) {
 async function listEnvVars(apiUrl, token, projectId, include = "all") {
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15478,7 +15733,7 @@ async function pullEnvValues(apiUrl, token, projectId, environment = "production
   const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15512,7 +15767,7 @@ async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime"
       method: "PUT",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${token}`
+        ...authHeaders(token)
       },
       // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
       // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
@@ -15553,7 +15808,7 @@ async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", en
   const query = params.toString() ? `?${params.toString()}` : "";
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15579,7 +15834,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId })
   });
@@ -15597,7 +15852,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId,
@@ -15615,7 +15870,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId, ...app ? { app } : {} })
   });
@@ -15627,7 +15882,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
-  const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
+  const res = await fetch(url2, { headers: { ...authHeaders(token) } });
   if (!res.ok) {
     throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
@@ -15731,7 +15986,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
     let dropped = false;
     try {
       const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/logs`, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
+        headers: { ...authHeaders(token), accept: "text/event-stream" }
       });
       if (!res.ok) {
         throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15773,7 +16028,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" },
+        headers: { ...authHeaders(token), accept: "text/event-stream" },
         ...opts.signal ? { signal: opts.signal } : {}
       });
       if (!res.ok) {
@@ -15803,7 +16058,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
 async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   const doFetch = opts.fetchImpl ?? fetch;
   const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/log`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15818,7 +16073,7 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
 async function fetchPushCredential(apiUrl, token, projectId) {
   const res = await fetch(
     `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15847,7 +16102,7 @@ async function supportFetch(apiUrl, token, path, what, init = {}) {
   const res = await fetch(`${apiUrl}${path}`, {
     method: init.method ?? "GET",
     headers: {
-      authorization: `Bearer ${token}`,
+      ...authHeaders(token),
       ...init.body !== void 0 ? { "content-type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
@@ -15897,181 +16152,6 @@ async function replySupportTicket(apiUrl, token, ref, text) {
   return body;
 }
 
-// src/config.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-var DEFAULT_API_URL = "http://localhost:3000";
-function configPath() {
-  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
-  return join(dir, "config.json");
-}
-function loadConfig() {
-  let raw;
-  try {
-    raw = readFileSync(configPath(), "utf8");
-  } catch {
-    return {};
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    process.stderr.write(
-      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
-`
-    );
-    return {};
-  }
-}
-function writeConfig(config2) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
-  chmodSync(path, 384);
-}
-function saveToken(token, apiUrl) {
-  const config2 = loadConfig();
-  config2.token = token;
-  if (apiUrl) config2.apiUrl = apiUrl;
-  writeConfig(config2);
-}
-function clearToken() {
-  const config2 = loadConfig();
-  delete config2.token;
-  writeConfig(config2);
-}
-var lastApiUrl = null;
-function resolveApiUrl(flag) {
-  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
-  return lastApiUrl;
-}
-function currentApiUrl() {
-  return lastApiUrl ?? resolveApiUrl();
-}
-var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
-function resolveDashboardUrl(flag) {
-  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
-}
-var PROJECT_LINK_DIR = ".kryd";
-var PROJECT_LINK_FILE = "project.json";
-function findProjectLinkDir(cwd = process.cwd()) {
-  let dir = cwd;
-  for (; ; ) {
-    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
-    if (existsSync(join(dir, ".git"))) return null;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function loadProjectLink(cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  let raw;
-  try {
-    raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
-`);
-    return null;
-  }
-  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
-    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
-`);
-    return null;
-  }
-  return parsed;
-}
-function saveProjectLink(cwd, link) {
-  const dir = join(cwd, PROJECT_LINK_DIR);
-  mkdirSync(dir, { recursive: true });
-  const path = join(dir, PROJECT_LINK_FILE);
-  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
-  return path;
-}
-function ensureIgnored(cwd, entry, aliases = []) {
-  const path = join(cwd, ".gitignore");
-  let current = "";
-  try {
-    current = readFileSync(path, "utf8");
-  } catch {
-  }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
-  if (present) return false;
-  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  appendFileSync(path, `${prefix}${entry}
-`);
-  return true;
-}
-function ensureKrydIgnored(cwd) {
-  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
-}
-function directoryIsLinked(cwd) {
-  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  if (!existsSync(path)) return null;
-  return loadProjectLink(cwd);
-}
-function writeSecretFile(path, contents) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents, { mode: 384 });
-  chmodSync(path, 384);
-}
-function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return false;
-  const link = loadProjectLink(cwd);
-  if (link?.projectId !== projectId) return false;
-  try {
-    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolvedLink() {
-  return lastLinkResolution;
-}
-var lastLinkResolution = null;
-function resolveProjectId(explicit, cwd = process.cwd()) {
-  lastLinkResolution = null;
-  if (explicit) return explicit;
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const link = loadProjectLink(cwd);
-  if (!link) return null;
-  lastLinkResolution = { root, link };
-  return link.projectId;
-}
-function rememberLinkAccount(root, account) {
-  if (!account.accountId) return false;
-  const link = directoryIsLinked(root);
-  if (!link) return false;
-  const slug = account.accountSlug ?? link.accountSlug;
-  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
-  saveProjectLink(root, {
-    ...link,
-    accountId: account.accountId,
-    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
-    ...slug ? { accountSlug: slug } : {}
-  });
-  return true;
-}
-
 // src/support.ts
 var SUPPORT_TYPES = TICKET_TYPES;
 var MESSAGE_MAX = 2e4;
@@ -16156,7 +16236,7 @@ function reportSupportError(err) {
   process.exitCode = 1;
 }
 function requireToken() {
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) usage("Not logged in \u2014 run `kryd login` first.");
   return token ?? null;
 }
@@ -16308,6 +16388,272 @@ async function runSupportReply(raw, opts) {
   }
 }
 
+// src/account.ts
+function fail(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function membershipLabel(m) {
+  return m.slug ?? m.name ?? m.accountId;
+}
+function accountHint(err) {
+  if (!(err instanceof ApiError) || !err.envelope) return "";
+  const { code, details } = err.envelope.error;
+  if (code === ERROR_CODES.accountRequired) {
+    return "You belong to several accounts. Choose one with `kryd account use <slug>` (`kryd account list` shows them).\n";
+  }
+  if (code === ERROR_CODES.permissionRequired) {
+    const permission = typeof details?.permission === "string" ? ` \`${details.permission}\`` : " this permission";
+    const slug = loadConfig().accountSlug;
+    return `Your role in ${slug ? `account ${slug}` : "this account"} lacks${permission}. Ask the account's owner, or switch with \`kryd account use <slug>\`.
+`;
+  }
+  const stored = loadConfig();
+  if (code === ERROR_CODES.forbidden && stored.account && /not a member/i.test(err.envelope.error.message)) {
+    const name = stored.accountSlug ?? stored.account;
+    return `You are no longer a member of account ${name}, which this machine has chosen. See your accounts with \`kryd account list\`, then pick one with \`kryd account use <slug>\`.
+`;
+  }
+  return "";
+}
+async function runAccountList(opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  let memberships;
+  let current;
+  try {
+    const me = await whoami(resolveApiUrl(opts.apiUrl), token);
+    memberships = me.memberships ?? [];
+    current = me.accountId;
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(memberships.map((m) => ({ ...m, current: m.accountId === current })), null, 2)}
+`);
+    return;
+  }
+  if (memberships.length === 0) {
+    process.stdout.write("You do not belong to any account.\n");
+    return;
+  }
+  const rows = [
+    ["", "SLUG", "NAME", "ROLE", "ID"],
+    ...memberships.map((m) => [m.accountId === current ? "*" : "", m.slug ?? "\u2014", m.name, m.role, m.accountId])
+  ];
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const r of rows) {
+    process.stdout.write(`${r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()}
+`);
+  }
+}
+async function runAccountUse(target, opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  if (token.startsWith("kryd_")) {
+    return fail("A deploy token is bound to one account and cannot switch. Unset KRYD_TOKEN to use your login.");
+  }
+  let memberships;
+  try {
+    memberships = (await whoami(resolveApiUrl(opts.apiUrl), token)).memberships ?? [];
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  const wanted = target.trim();
+  const match = memberships.find((m) => m.slug === wanted || m.accountId === wanted);
+  if (!match) {
+    const known = memberships.map(membershipLabel).join(", ") || "none";
+    return fail(`You are not a member of an account "${wanted}". Your accounts: ${known}.`);
+  }
+  saveAccount({ accountId: match.accountId, slug: match.slug });
+  process.stdout.write(`Now using account ${membershipLabel(match)} (${match.role}).
+`);
+}
+async function settleAccountAfterLogin(apiUrl, token) {
+  if (token.startsWith("kryd_")) return;
+  let memberships;
+  try {
+    memberships = (await whoami(apiUrl, token)).memberships ?? [];
+  } catch {
+    return;
+  }
+  const stored = loadConfig().account;
+  if (stored && memberships.some((m) => m.accountId === stored)) return;
+  if (memberships.length <= 1) {
+    if (stored) clearAccount();
+    return;
+  }
+  const pick2 = memberships.find((m) => m.role === "owner") ?? memberships[0];
+  saveAccount({ accountId: pick2.accountId, slug: pick2.slug });
+  process.stdout.write(
+    `You belong to ${memberships.length} accounts; using ${membershipLabel(pick2)}. Switch with \`kryd account use <slug>\`.
+`
+  );
+}
+
+// src/tokens.ts
+var TOKEN_EXPIRY_CHOICES = ["30", "90", "365", "never"];
+var DEFAULT_TOKEN_EXPIRY = "90";
+var MAX_TOKEN_NAME = 32;
+function expiresInSeconds(choice) {
+  if (choice === "never") return null;
+  if (!TOKEN_EXPIRY_CHOICES.includes(choice)) return void 0;
+  return Number(choice) * 24 * 60 * 60;
+}
+async function tokenFetch(apiUrl, token, path, what, body) {
+  const res = await fetch(`${apiUrl}/api/auth/api-key/${path}`, {
+    method: body === void 0 ? "GET" : "POST",
+    headers: {
+      ...authHeaders(token),
+      ...body !== void 0 ? { "content-type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  if (!res.ok) {
+    const parsed = await res.json().catch(() => void 0);
+    const message = typeof parsed?.message === "string" ? parsed.message : `${what} failed (${res.status})`;
+    const code = typeof parsed?.code === "string" ? parsed.code : `http.${res.status}`;
+    throw new ApiError(`${what} failed (${res.status})`, { error: { code, message } }, res.status);
+  }
+  try {
+    return await res.json();
+  } catch {
+    throw new ApiError(`The API returned an unexpected answer to "${what.toLowerCase()}".`);
+  }
+}
+var isToken = (v) => {
+  const t = v;
+  return typeof t?.id === "string" && typeof t?.createdAt === "string";
+};
+async function createDeployToken(apiUrl, token, input) {
+  const body = await tokenFetch(apiUrl, token, "create", "Creating the token", input);
+  if (!isToken(body) || typeof body.key !== "string" || body.key.length === 0) {
+    throw new ApiError("The API returned an unexpected answer to creating the token.");
+  }
+  return body;
+}
+async function listDeployTokens(apiUrl, token) {
+  const body = await tokenFetch(apiUrl, token, "list", "Listing the tokens");
+  if (!Array.isArray(body?.apiKeys) || !body.apiKeys.every(isToken)) {
+    throw new ApiError("The API returned an unexpected answer to listing the tokens.");
+  }
+  return body.apiKeys;
+}
+async function revokeDeployToken(apiUrl, token, id) {
+  await tokenFetch(apiUrl, token, "delete", "Revoking the token", { keyId: id });
+}
+function fail2(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function reportTokenError(err) {
+  if (err instanceof ApiError && err.status === 401) {
+    fail2("Not logged in, or the session expired \u2014 run `kryd login`.");
+  } else if (err instanceof ApiError && err.status === 403 && resolveToken()?.startsWith("kryd_")) {
+    fail2(
+      "A deploy token cannot manage tokens. Sign in with `kryd login` (and unset KRYD_TOKEN for this command)."
+    );
+  } else if (err instanceof ApiError && err.status === 404) {
+    fail2("No such token on your account. `kryd token list` shows their ids.");
+  } else if (err instanceof ApiError && err.envelope) {
+    fail2(err.envelope.error.message);
+    process.stderr.write(accountHint(err));
+  } else {
+    fail2(err instanceof Error ? err.message : String(err));
+  }
+}
+function requireToken2() {
+  const token = resolveToken();
+  if (!token) fail2("Not logged in \u2014 run `kryd login` first.");
+  return token ?? null;
+}
+var day = (iso) => iso ? iso.slice(0, 10) : "\u2014";
+async function runTokenCreate(name, opts) {
+  const trimmed = name.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_TOKEN_NAME) {
+    return fail2(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
+  }
+  const choice = opts.expires ?? DEFAULT_TOKEN_EXPIRY;
+  const expiresIn = expiresInSeconds(choice);
+  if (expiresIn === void 0) {
+    return fail2(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
+  }
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    const apiUrl = resolveApiUrl(opts.apiUrl);
+    const created = await createDeployToken(apiUrl, token, { name: trimmed, expiresIn });
+    process.stdout.write(`${created.key}
+`);
+    const account = await boundAccountLabel(apiUrl, token, created);
+    process.stderr.write(
+      `Created deploy token "${trimmed}" (${created.id})${account ? ` for account ${account}` : ""}, ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
+This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOKEN.
+`
+    );
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+async function boundAccountLabel(apiUrl, token, created) {
+  const id = typeof created.metadata?.accountId === "string" ? created.metadata.accountId : null;
+  if (!id) return null;
+  try {
+    const me = await whoami(apiUrl, token);
+    const m = me.memberships?.find((x) => x.accountId === id);
+    return m?.slug ?? id;
+  } catch {
+    return id;
+  }
+}
+async function runTokenList(opts) {
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    const list = await listDeployTokens(resolveApiUrl(opts.apiUrl), token);
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(list, null, 2)}
+`);
+      return;
+    }
+    if (list.length === 0) {
+      process.stdout.write("No deploy tokens. Create one with `kryd token create <name>`.\n");
+      return;
+    }
+    const rows = [
+      ["ID", "NAME", "STARTS WITH", "CREATED", "LAST USED", "EXPIRES"],
+      ...list.map((t) => [
+        t.id,
+        t.name ?? "\u2014",
+        t.start ? `${t.start}\u2026` : "\u2014",
+        day(t.createdAt),
+        day(t.lastRequest),
+        t.expiresAt ? day(t.expiresAt) : "never"
+      ])
+    ];
+    const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+    for (const r of rows) {
+      process.stdout.write(`${r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()}
+`);
+    }
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+async function runTokenRevoke(id, opts) {
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id);
+    process.stdout.write(`Revoked ${id}. Anything still using it now gets 401.
+`);
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+
 // src/browser-login.ts
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -16396,7 +16742,7 @@ async function runGitCredential(operation, opts = {}) {
   const input = parseCredentialInput(opts.stdin ?? "");
   if (input.protocol && input.protocol !== "https") return;
   const cwd = opts.cwd ?? process.cwd();
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return;
   const projectId = resolveProjectId(void 0, cwd);
   if (!projectId) return;
@@ -17588,6 +17934,7 @@ async function reportError(err) {
     process.stderr.write(`${err instanceof Error ? err.message : String(err)}
 `);
   }
+  process.stderr.write(accountHint(err));
   process.exitCode = 1;
   if (err instanceof ApiError) {
     process.stderr.write(await explainMissingProject(err));
@@ -17607,7 +17954,7 @@ async function explainMissingProject(err) {
   if (err.status !== 404) return "";
   const resolution = resolvedLink();
   if (!resolution) return "";
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return "";
   if (await projectIsVisible(token, resolution.link.projectId) !== false) return "";
   let session;
@@ -17635,7 +17982,7 @@ async function backfillLinkAccount() {
   const resolution = resolvedLink();
   if (!resolution) return;
   if (resolution.link.accountId && resolution.link.accountSlug) return;
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return;
   if (await projectIsVisible(token, resolution.link.projectId) !== true) return;
   try {
@@ -17660,33 +18007,51 @@ async function runLogin(opts) {
   if (pastedToken) {
     saveToken(pastedToken, apiUrl);
     process.stdout.write("Token saved.\n");
+    warnIfEnvTokenOverrides();
     return;
   }
   const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(opts.dashboardUrl));
   saveToken(token, learnedApiUrl ?? apiUrl);
   process.stdout.write("Logged in.\n");
+  await settleAccountAfterLogin(learnedApiUrl ?? apiUrl, token);
+  warnIfEnvTokenOverrides();
 }
 async function runWhoami(opts = {}) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token ?? "";
+  const token = resolveToken() ?? "";
   try {
     const me = await whoami(apiUrl, token);
-    process.stdout.write(
-      `${me.email} (account ${me.accountId ?? "?"}, role ${me.role ?? "?"})
+    const current = me.memberships?.find((m) => m.accountId === me.accountId);
+    const label = current?.slug ?? me.accountSlug ?? me.accountId ?? "?";
+    process.stdout.write(`${me.email} (account ${label}, role ${current?.role ?? me.role ?? "?"})
+`);
+    const others = (me.memberships ?? []).filter((m) => m.accountId !== me.accountId);
+    if (others.length > 0) {
+      process.stdout.write(
+        `Also in: ${others.map((m) => `${m.slug ?? m.accountId} (${m.role})`).join(", ")} \u2014 switch with \`kryd account use <slug>\`.
 `
-    );
+      );
+    }
   } catch (err) {
     await reportError(err);
   }
 }
+function warnIfEnvTokenOverrides() {
+  if (process.env.KRYD_TOKEN?.trim()) {
+    process.stderr.write(
+      "KRYD_TOKEN is set in this shell and overrides the stored login; commands keep using it until you unset it.\n"
+    );
+  }
+}
 function runLogout() {
   clearToken();
   process.stdout.write("Logged out.\n");
+  warnIfEnvTokenOverrides();
 }
 async function runInit(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const cwd = opts.cwd ?? process.cwd();
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -17909,7 +18274,7 @@ async function replayStoredLog(apiUrl, token, deploymentId) {
 }
 async function runLogs(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -17961,7 +18326,7 @@ async function runLogs(opts) {
 }
 async function runRuntimeLogs(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18018,7 +18383,7 @@ async function runRuntimeLogs(opts) {
 }
 async function runDeploy(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18054,7 +18419,7 @@ function renderFor(logs) {
 var LOGS_FLAG_HELP = "stream the full build log line by line instead of the progress display";
 async function runPush(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18206,7 +18571,7 @@ async function followApps(apiUrl, token, deployments, render, estimateFrom) {
 }
 async function runRollback(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18237,7 +18602,7 @@ async function runRollback(opts) {
 }
 async function runRedeploy(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18267,7 +18632,7 @@ ${note}
 }
 async function runDbAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18348,7 +18713,7 @@ function reportSettleResult(result, opts) {
 }
 async function runStorageAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18442,7 +18807,7 @@ ${listed}Re-run \`kryd project rm <id>\` with the one you mean.
 }
 async function runProjectRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18557,7 +18922,7 @@ async function describeProjectResources(apiUrl, token, projectId) {
 }
 async function runDbRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18596,7 +18961,7 @@ async function runDbRemove(opts) {
 }
 async function runAiAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18621,7 +18986,7 @@ async function runAiAdd(opts) {
 }
 async function runAiRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18688,7 +19053,7 @@ Remove it before attaching another.
 }
 async function runDbStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18708,7 +19073,7 @@ async function runDbStatus(opts) {
 }
 async function runStorageStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18728,7 +19093,7 @@ async function runStorageStatus(opts) {
 }
 async function runAiStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18764,7 +19129,7 @@ function daysUntil(iso) {
 var TOKEN_EXPIRY_WARNING_DAYS = 30;
 async function runWorkflowAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18797,7 +19162,7 @@ HATCHET_CLIENT_TOKEN will be injected on your next production deploy (kryd deplo
 }
 async function runWorkflowRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18842,7 +19207,7 @@ Workflow history, crons and schedules stay until the project is deleted.
 }
 async function runWorkflowStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18901,7 +19266,7 @@ function formatDomainRecords(records) {
 }
 function domainContext(opts, usage2) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19308,7 +19673,7 @@ HATCHET_CLIENT_TOKEN is injected into your app and your worker on production dep
 }
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19371,7 +19736,7 @@ function envAnnotation(environments) {
 }
 async function runProjectList(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19422,7 +19787,7 @@ ${rows}`;
 }
 async function runEnvList(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19504,7 +19869,7 @@ function toDotenvLine(key, value) {
 }
 async function runEnvPull(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19605,7 +19970,7 @@ async function runEnvSet(opts) {
   const scope = opts.build ? "build" : "runtime";
   const environment = opts.preview ? "preview" : "production";
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19700,7 +20065,7 @@ async function runEnvRemove(opts) {
   const scope = opts.build ? "build" : "runtime";
   const environment = opts.preview ? "preview" : "production";
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19794,7 +20159,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.14.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.16.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -19805,6 +20170,9 @@ program.command("login").description("Sign in via the browser (default) and stor
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
+var accountCommand = program.command("account").description("The accounts you belong to, and which one commands run in");
+accountCommand.command("list").description("List your accounts and your role in each; * marks the one commands run in").option("--json", "print the accounts as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runAccountList(opts));
+accountCommand.command("use <slug>").description("Run every following command in this account").option("--api-url <url>", "control-plane API base URL").action((slug, opts) => runAccountUse(slug, opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
   const chunks = [];
@@ -19942,6 +20310,10 @@ support.command("new").description(
 support.command("list").description("Your account's tickets, with their status").option("--json", "print { items } as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runSupportList(opts));
 support.command("show <ticket>").description("One ticket and its conversation, e.g. `kryd support show T-1042`").option("--json", "print the ticket and its messages as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportShow(ticket, opts));
 support.command("reply <ticket>").description("Answer in a ticket's conversation \u2014 the ticket goes back to Kryd support (status open)").option("--message <text>", "your reply (required)").option("--json", "print the updated ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportReply(ticket, opts));
+var tokenCommand = program.command("token").description("Deploy tokens for CI and scripts: set one as KRYD_TOKEN and every command uses it, no login needed");
+tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, bound to the current account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
+tokenCommand.command("list").description("Your deploy tokens: name, first characters, created, last used, expiry \u2014 never the value").option("--json", "print the tokens as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runTokenList(opts));
+tokenCommand.command("revoke <id>").description("Revoke a deploy token; anything still using it gets 401").option("--api-url <url>", "control-plane API base URL").action((id, opts) => runTokenRevoke(id, opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;